Buy Now, Pay Later was designed to make shopping frictionless. For fraudsters, frictionless is another word for opportunity.

BNPL services - Klarna, Afterpay, Affirm, Clearpay, and dozens more - have exploded in adoption, with global transaction values exceeding $300 billion annually. The model's appeal is built on speed and simplicity: instant credit decisions, no hard credit inquiry, split payments without interest. And that speed, combined with lighter identity verification than traditional credit products, has made BNPL one of the fastest-growing fraud vectors in consumer finance.

How fraudsters exploit Buy Now, Pay Later:

🎭 Account takeover (ATO) - Legitimate BNPL accounts with established spending limits are among the most targeted accounts in ATO campaigns. Attackers use credential stuffing, phishing, and SIM-swapping to take over accounts, change delivery addresses, and place orders before the real customer notices. The time window between takeover and order delivery is often shorter than the fraud detection cycle.

🧬 Synthetic identity fraud at account opening - BNPL providers originally competed on approval speed, which meant lighter verification at account opening than traditional lenders. Fraudsters exploit this with synthetic identities - fabricated personas built on real SSNs - to open accounts, build spending history, and then "bust out" with high-value purchases they never intend to repay.

🔄 First-party fraud and intentional default - Real customers occasionally open BNPL accounts with no intention of completing payments. Because BNPL debt recovery is typically slower and softer than credit card chargebacks, some consumers treat BNPL purchases as interest-free without accepting the repayment obligation. At scale, this represents a significant loss category.

📦 Triangulation fraud - A fraudster sets up a fake online store with attractive prices. A genuine customer purchases. The fraudster uses a stolen BNPL account or credit card to buy the real product from a legitimate retailer and ships it to the genuine customer. The fraudster collects the customer's payment and the stolen account holder bears the BNPL debt. Two victims, one fraudster, one seamless customer experience.

⚡ Velocity attacks across multiple providers - Because BNPL accounts often don't share data across providers, fraudsters apply to multiple BNPL services simultaneously or sequentially, accumulating credit across platforms before any individual provider detects the pattern. The absence of a centralized BNPL credit registry in many jurisdictions enables this.

🏪 Merchant-side fraud - Fraudulent merchants integrate BNPL checkout, process high-value transactions for non-existent or misrepresented goods, collect the BNPL advance from the provider, and disappear before chargebacks or disputes are raised. BNPL providers bear the credit risk; merchants can exit quickly.

The scale of BNPL fraud has grown with the sector's adoption. Sift's Digital Trust and Safety Index documented a 54% increase in BNPL fraud attempts between 2021 and 2023. TransUnion research found that BNPL accounts are three times more likely to experience first-payment default compared to traditional credit products, with a significant portion attributable to fraud rather than genuine financial hardship.

What can we do:

For BNPL providers:

- Invest in robust identity verification at account opening, including biometric checks and device fingerprinting - not just soft credit pulls and email verification.

- Share data with fraud consortiums and consider participating in open banking frameworks that enable real-time income and identity verification.

- Implement behavioral analytics that detect velocity patterns across providers and flag bust-out indicators early in the account lifecycle.

- Apply strong authentication at point of purchase for orders above value thresholds or with new delivery addresses.

For consumers:

- Monitor your BNPL accounts as actively as your bank accounts. ATO on BNPL often goes undetected until the debt recovery phase.

- Enable all available alerts for purchases and account changes.

- Use unique passwords and enable MFA on BNPL accounts - credentials from data breaches are actively tested against BNPL platforms.

- Be skeptical of unusually good deals from unfamiliar online stores - triangulation fraud creates a plausible purchase experience for the consumer victim.

Pay later doesn't mean someone else pays. It means fraud pays now.